Written by:
Purandar Das Partnership is a commitment and exposure to risk is a crucial criterion for assessment, this holds true in every aspect of life. In business decisions about new technologies and solutions, a candidate’s track record on cybersecurity is more than just a part of the discussion. It is often the deciding factor in adoption.
Delivering a quality product or service while ensuring security and privacy has long been a difficult balancing act. It’s too easy to justify cutting back on the security controls or planning to implement them “later” to maximize the speed of a product release.
Unfortunately, “later” often only comes after a breach. This leaves organizations vulnerable and their data exposed until the security gap is exploited. Cyber security incidents have risen 125% in volume year-over-year, and businesses have been keenly interested in how their partners protect the data entrusted to them. Even the federal government is taking a firmer stance on the security expected of vendors and service providers with President Biden’s Executive Order in 2020.
Data security can no longer be an afterthought for organizations. In this article, we explore the role managing your risks and exposures plays in partnership and purchasing decisions.
Data Security Affects Your Bottom Line
How well your organization protects its data directly impacts its future business. Despite frequently being seen as a cost center, the quality of your security directly impacts your brand and how it is perceived. Both consumers and other businesses consider your data security posture in their buying decisions.
Breaches come with significant costs which encompass direct financial cost and the cost of reputational damage. Current research with IBM and the Ponemon Institute shows an average price of $4.24 million to businesses that suffer a security breach. Almost 38% of this cost is directly attributable to lost business.
Consumers Care About Data Security
With the increase in data breaches and disclosures of personal information, customers are keenly interested in how organizations handle their data. General Data Protection Regulation (GDPR) and the California Consumer Protection Act (CCPA) were made in direct response. Still, even with these compliance frameworks, there is no guarantee of the security of customer data.
Both GDPR and CCPA significantly restrict how data is shared and used but do not protect against attackers. They instead outline ways in which customers gain control over how their information is shared and used by an organization. When these rules are not adhered to, including when data is accidentally disclosed or breached, they also come with rather costly penalties. These penalties increase if the disclosure was due to negligence on the part of the business.
It is not like businesses can pay the fine and sweep it under the rug. News media frequently picks up when customer data is disclosed from a breach and publicizes it, especially if it is a well-known organization or the number is significant. This negative publicity directly affects the reputation of an organization or its product.
No One Wants an Insecure Business Partner
Everyone’s watching. Customers care about security so businesses do. When an organization is outed for failing to protect sensitive data, everyone’s paying attention. When a company is determining what solutions and which service providers to utilize, security posture and track record defending data are more than just bullet points, often these are critical factors in decision-making.
Businesses need to know the data they entrust to their partners is fully protected. Critical failures are a strike against your business when future deals are up for consideration. Risk or exposure can send current customers seeking other solutions and prevent contract renewal or collapse existing partnerships.
The Biden Executive Order increased the standard government agencies must adhere to regarding the current and historic security posture of their partners. For those doing business with the department of defense, the Cybersecurity Maturity Model Certification (CMMC) deadline for third-party auditing of controls may have been moved out later. However, the need to ramp up security is still coming. This is likely only the start of cybersecurity requirements to be mandated by the government.
Exposure is Risky
No matter how mature your security model is, there is likely still room for improvement. As was seen with the recent Log4J vulnerabilities, even when businesses have trusted solutions, there is still potential for extremely high-risk exposures to be discovered. Companies can do a lot to decrease their exposure to data loss and disclosure.
One of the easiest ways to get started is the traditional route of closing up known or potential vulnerabilities in infrastructure. Then there is the alternative of taking a data-centric approach to security where protecting the data is of utmost importance, and all other controls stem from this. A data-centric approach is a more holistic approach to security that, in return, hardens the entire infrastructure, making your organization a more challenging target for attackers.
Eliminate Weak Links
Hackers go for the weakest link when attempting to gain access to data. In December 2021, this was reinforced with the recent log4j vulnerability discovery. This vulnerability allows attackers to execute code remotely and quickly escalate to take over the endpoint if exploited.
Log4Jj as an open-source component was deeply entrenched in many products used in production systems. Many of these production systems were directly accessible on the internet, forcing organizations to scramble to find and eliminate vulnerable Log4j versions quickly. Those that failed to do this were rapidly identified as targets and attacked.
Protecting What Matters – Your Data
It is essential to keep in mind that the central target of attackers is the data. This is where the value is for attackers when selling it on the dark web. Attackers can sell everything from personal information to product information and company financial data. Keeping this data protected makes your organization a less enticing target for attackers.
Data-centric security works throughout the organization applying controls to protect the data. Some of these protections come in the form of access control which limits individuals only to access the data they need to do their jobs. Other controls, such as data encryption, keep the data protected. Even if an attacker gets into the organization and steals the data, it is entirely unreadable to them without the keys. Controls such as these make it harder for attackers to steal your data.
A data-centric approach to security still includes essential steps such as resolving vulnerabilities. Reducing exposures and hardening endpoints removes the easy pathways that attackers can use to attempt to gain access to the data.
Finding Allies
When working to reduce the exposure of your data, it is crucial to have a trusted ally. Sotero has the experience to transform your enterprise security and protect your most valued asset, your data. With Sotero’s data security platform, your data remains secure, even when queried.
Sotero takes a holistic approach to data security and defends your data when it is at rest and when it is in use. Using active threat detection, the Sotero platform constantly watches for misuse of data and other indicators that an attacker is attempting to gain access to your information. Read more about how the Sotero Data Security platform can help your organization take control of its security and not become a security failure headline.